Trouble with Let's Encrypt cross-signed certificate?

BarryCarlyon · October 7, 2021, 7:34pm

See this post

github.com/electron/electron

[Bug]: Let's Encrypt root CA isn't working properly

opened 02:56PM - 30 Sep 21 UTC

closed 08:22PM - 30 Sep 21 UTC

leonekmi

bug

### Preflight Checklist - [X] I have read the [Contributing Guidelines](https…://github.com/electron/electron/blob/main/CONTRIBUTING.md) for this project. - [X] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project adheres to. - [X] I have searched the [issue tracker](https://www.github.com/electron/electron/issues) for a feature request that matches the one I want to file, without success. ### Electron Version 15.0.0 Reproduced on Electron 12, 13, 14 ### What operating system are you using? Other Linux ### Operating System Version Arch Linux rolling ### What arch are you using? x64 ### Last Known Working Electron version _No response_ ### Expected Behavior The request to `https://letsencrypt.org` (or any Let's Encrypt secured website) should work in the main process as the certificate chain seems valid. ### Actual Behavior It doesn't work in the main process. However, it works in the renderer (with standard Fetch API) or in Node 16.5 REPL (also with Axios). ### Testcase Gist URL https://gist.github.com/fc9cc8d91df7d02f211698f9aceb0087 ### Additional Information I think it's probably related to the recent expiry of DST Root CA X3 but strangely enough, it's working properly on the renderer and in a single Node app? My understanding is that by default, Node.js uses a capture of the Mozilla trust CA, could it be that the Electron one is unsynced?

Which describes a solution